XBOW安全研究团队利用AI代理在仅6天内完成了首条Chrome完整链漏洞利用1。这一成果标志着浏览器安全研究的重大进展——在生成式AI模型出现前，类似的完整链攻击通常需要6至9个月才能完成1。
该漏洞链由三个阶段的漏洞组成1。首先是V8编译器（Maglev编译器）的沙箱逃逸漏洞，其次是animated-WebP解码器中的TOCTOU（检查-使用）漏洞，最后是Crashpad进程冻结绕过漏洞，三者环环相扣最终实现从JavaScript执行逃逸至渲染器沙箱外的代码执行1。XBOW团队采用OpenAI的gpt-5.6-sol模型进行辅助研究，API费用约为4万美元1。从2024年8月2日至8月7日，这六天间的工作完整记录了从零到功能性完整链攻击的全过程1。
Google VRP（漏洞赏金计划）为该漏洞链颁发了首个25万美元的Chrome完整链奖励，该金额系根据2026年4月更新的VRP规则确定1。三个相关漏洞分别被编号为Chromium issue 547819997（V8）、Chromium issue 548509153（WebP）和Chromium issue 545820931（Crashpad）1。
The XBOW security research team has developed a complete exploit chain for Google Chrome in just six days, marking a significant acceleration in vulnerability discovery timelines.1 The chain, completed between August 2 and August 7, 2024, combines three distinct vulnerabilities: a V8 sandbox escape through the Maglev compiler, a time-of-check-time-of-use flaw in the animated-WebP decoder, and a Crashpad memory safety vulnerability that bypasses process freezing protections.1 The exploit enables attackers to execute arbitrary code outside the renderer sandbox, progressing from JavaScript execution to full system compromise.1
Google has awarded the finding its inaugural $250,000 Chrome full chain reward under the updated Vulnerability Rewards Program rules effective April 2026, recognizing the severity and completeness of the vulnerability chain.1 The research cost approximately $40,000 in API fees and relied on OpenAI's gpt-5.6-sol AI model to accelerate the discovery process.1 This represents a dramatic compression of the exploitation timeline—previously, developing a complete Chrome chain required six to nine months before AI-assisted research became commonplace, yet XBOW delivered its first version within two months and this award-winning variant in just six days.1 The vulnerabilities have been catalogued as Chromium issues 547819997 (V8), 548509153 (WebP), and 545820931 (Crashpad).1
评论
还没有评论，欢迎留下第一条。